Subject: [dhcwg] I-D ACTION:draft-ietf-dhc-agentopt-radius-08.txt

From: [email-masked]
Date: Wed, 08 Sep 2004 15:35:57 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Dynamic Host Configuration Working Group of the IETF.

	Title		: RADIUS Attributes Sub-option for the DHCP Relay Agent Information Option
	Author(s)	: R. Droms, J. Schnizlein
	Filename	: draft-ietf-dhc-agentopt-radius-08.txt
	Pages		: 9
	Date		: 2004-9-8
	
A NAS (network access server) may choose to authenticate the identity
   of a device before granting that device access to the network.  The
   IEEE 802.1X protocol is an example of a mechanism for providing
   authenticated layer 2 network access.  A network element using RADIUS
   as an authentication authority will receive attributes from a RADIUS
   server that may be used by a DHCP server in the selection of
   configuration parameters to be delivered to the device through its
   DHCP client. The RADIUS Attributes sub-option enables a network
   element to pass along attributes for the user of a device received
   during RADIUS authentication to a DHCP server.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dhc-agentopt-radius-08.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-dhc-agentopt-radius-08.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-dhc-agentopt-radius-08.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Mayumi Yanagiya <[email-masked]>
Date: Fri, 10 Sep 2004 22:11:23 +0900

I have a question.

>>4. DHCP Relay Agent Behavior
>
>
>When the DHCP relay agent receives a DHCP message from the client, it
>MAY append a DHCP Relay Agent Information option containing the
>RADIUS Attributes sub-option, along with any other sub-options it is
>configured to supply.  The RADIUS Attributes sub-option MUST only
>contain the attributes provided in the RADIUS Access/Accept message.
>The DHCP relay agent MUST NOT add more than one RADIUS Attributes
>sub-option in a message.
>
>The relay agent MUST include the User-Name and Framed-Pool attributes
>in the RADIUS Attributes sub-option if available, and MAY include
>other attributes.
>
>To avoid dependencies between the address allocation and other state
>information between the RADIUS server and the DHCP server, the DHCP
>relay agent SHOULD include only the attributes in the table below an
>instance of the RADIUS Attributes sub-option.  The table, based on
>the analysis in RFC 3580 [10], lists attributes that MAY be included:

I'm not sure what "other state information" is.
I can’t understand the reason why dependencies between
the address allocation and other state information should be avoided.
Will any problem be caused if we define new attribute?

--Mayumi

[email-masked] wrote:
> ------------------------------------------------------------------------
>

---

From: John Schnizlein <[email-masked]>
Date: Fri, 10 Sep 2004 09:37:15 -0400

We were told by the AAA experts that the RADIUS model involves keeping state about the remote host regarding some attributes. It would be wrong to attempt to manage this state in both the RADIUS and DHCP servers. The most obvious is the IP address, but they advised us that all but those in the list in agentopt-radius-08 might cause problems for the RADIUS server.

John

At 09:11 AM 9/10/2004, Mayumi Yanagiya wrote:
>I can't understand the reason why dependencies between